Agent Tesla RAT Loader Detection - Variant Family

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•5

This rule detects the execution of processes that contain keywords associated with Agent Tesla, RedLine, or other stealers in their command line, specifically when initiated by common Windows utilities like PowerShell, CMD, or rundll32. This pattern often indicates the loading or execution of malware.